Rate limits

Limits are per credential, not per IP, so one noisy integration cannot starve another.

Limits and backoff

Limits are per credential, not per IP, so one noisy integration cannot starve another. The default ceiling is 120 requests per minute per token, and it can be lowered per token in the panel.

SMS also has per-account anti-fraud ceilings, independent of the request rate: at most 10 SMS per rolling 24 h to the same destination number, and a daily SMS spend limit that grows with your confirmed payments. Both return 429 with a reason field (DESTINATION_FLOOD or SMS_DAILY_SPEND): if you expect legitimate volume beyond them, contact support.

Over the limit you get 429. Back off exponentially and retry with the same Idempotency-Key: that is exactly the case the key exists for.